Nefilim

Nefilim is a malware, specifically a ransomware, that has been responsible for significant cyber threats globally. It infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. Between 2019 and 2021, Nefilim was linked to various Ransomware-as-a-Service (RaaS) schemes, including JSWorm, Karma, Nemty, and its own RaaS program. Alongside Clop, Nefilim accounted for the highest number of ransomware family detections during this period, with Crysis and Doppelpaymer following behind. Notably, Nefilim was also Africa's most prevalent banking malware from January to April 2021. The Nefilim ransomware has been associated with several high-profile cyber incidents. In one instance, the Italian website "Difesa e Sicurezza" reported in October that operators of the Nefilim ransomware had posted a list of files appearing to belong to Luxottica on the dark web. The malware has been observed to drop MegaSync into its normal file path under its standard name, with adversaries executing renamed instances of Mega during incident response engagements related to Nefilim and other ransomware families like Sodinokibi, Pysa, and Conti. Behind Nefilim's operations is farnetwork, a notorious entity involved in several ransomware projects since 2019, including JSWorm, Karma, Nemty, and Nefilim itself. Farnetwork, known by multiple handles such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit, helped develop ransomware and manage the RaaS programs for these projects before launching their own RaaS program based on Nokoyawa ransomware in 2022. The Nefilim's RaaS program alone accounted for over 40 victims, with Nokoyawa's dedicated leak site containing information about 35 victims.